Step 4 - Penetration

We successfully logged in using pirrips private/public rsa keys. Lets take a look at the /etc/passwd file for fun

Notice that Pirrip is in a different group from magwitch and havisham. From here I was stuck for a little while. I tried unsuccessfully to download the /etc/shadow file using ssh.

So I decided to start looking around the box and see if there are any interesting directories or files. I ended up  looking at the /var/mail directory

Hmm email. Maybe theres some good stuff in there...

Hey check that out, theres pirrips password!

Step 4 - Penetration

Now that we have some usernames lets see if we can bruteforce some passwords

I dont have much practice with basic shell scripting so I decided to see if I could write a basic script that would input the usernames for me and let me put in password guesses manually. Dont laugh too hard at my first attempt

Yeah, so that one didn't work so well. Actually it didn't work at all. Heres my second attempt

This one actually worked. Sure its ugly but it did what I wanted. Once the script was running I tried using the username as the password. Surprisingly the intern (go figure) had a weak password and used his login ID as his password